wicked-garden 12.52.0 → 12.52.1

package/.claude-plugin/marketplace.json

@@ -1 +1 @@
-{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.52.0"}], "version": "12.52.0"}
+{"name": "wicked-garden", "owner": {"name": "Mike Parcewski"}, "plugins": [{"name": "wicked-garden", "source": "./", "description": "Your coding agent already plans and swarms \u2014 Wicked Garden is the curated toolkit for what it can't: proof-not-claims gates, code links grep can't see, deterministic refactor, cross-session memory, multi-model second opinions (fallback seats labelled). Don't fight the harness; fill its gaps. The gate needs wicked-vault (a self-contained infra peer, installed directly) and re-derives through garden's built-in engine; estate/bus are opt-in layers (wicked-testing and wicked-brain are retired \u2014 QE ships in-catalog as the qe domain, memory lives in wicked-estate).", "version": "12.52.1"}], "version": "12.52.1"}

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.52.0",
+  "version": "12.52.1",
   "description": "Your coding agent's harness already plans and swarms; Wicked Garden is the curated toolkit for what it can't do alone. Proof, not claims \u2014 gates re-derive 'done' through the internal loom engine (fail-closed, independently attested via wicked-vault), so a self-asserted pass can't lie its way green. Relationships grep can't see \u2014 the wicked-estate code graph + injected bus/dispatch/capability/archetype edges power blast-radius & lineage. Plus deterministic multi-file refactor (wicked-patch), cross-session memory + knowledge (the mem domain over wicked-estate), multi-model second opinions (fallback seats labelled) (jam:council), portable expertise as on-demand skill-refs, and evidence-gated testing (the in-catalog qe domain). It reads the shape of your work to apply the right rigor \u2014 steering, not a pipeline \u2014 then gets out of the way. The compiler stamps a self-contained evidence gate into any repo that runs with no wicked-garden installed. Don't fight the harness; fill its gaps. The evidence gate requires wicked-vault, a self-contained infra peer wicked-garden installs directly; wicked-bus is an opt-in layer \u2014 install what you'll use, the toolkit works without the rest.",
   "wicked_vault_version": "^0.5.0",
   "wicked_ledger_version": "^0.6.0",

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 ## [Unreleased]
 
+## [12.52.1] — 2026-10-11
+
+### Changed
+- **The memory durability gate refuses only the unambiguous (w9-memfix3, PR #1283).** `store` / `capture-batch` refuse a body under 40 characters, a bare id / SHA / version, and first-person progress narration. Ids, versions, SHAs, PIDs and date words inside a body are returned as `warnings` and the store succeeds. "Keep SQLite >= 3.35.0 because RETURNING …" and "CRC32 polynomial edb88320 … database commit …" are stored. The three-month test in the mem skills is the agent's judgment.
+
+### Fixed
+- **Relative-path worktrees resolve to their main checkout's project scope** (`gitdir: ../../.git/worktrees/run` is resolved against the `.git` file, and `commondir` is followed), not `project:..`.
+
 ## [12.52.0] — 2026-10-11
 
 ### Changed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "wicked-garden",
-  "version": "12.52.0",
+  "version": "12.52.1",
   "type": "module",
   "description": "Curated toolkit for what AI coding agents can't do alone: evidence-gated work, codegraph relationships, deterministic multi-file refactor, multi-model second opinions, and cross-session memory. Installs as a Claude Code plugin.",
   "keywords": [

package/scripts/_estate_client.py

@@ -963,6 +963,30 @@ def context(
     return call("ContextBundle", args, timeout=timeout)
 
 
+def _worktree_main(git_file: Path) -> Optional[Path]:
+    """Main checkout of a linked worktree whose ``.git`` file is ``git_file``.
+
+    ``gitdir:`` may be relative to the ``.git`` file's directory
+    (``git worktree add --relative-paths``); the worktree's ``commondir``
+    names the shared git dir (relative to the gitdir). The main checkout is
+    that git dir's parent. None when the file is not a worktree pointer.
+    """
+    try:
+        line = git_file.read_text(encoding="utf-8").strip()
+    except OSError:
+        return None
+    if not line.startswith("gitdir:"):
+        return None
+    gitdir = (git_file.parent / line[len("gitdir:"):].strip()).resolve()
+    try:
+        common = (gitdir / (gitdir / "commondir").read_text(encoding="utf-8").strip()).resolve()
+    except OSError:
+        common = gitdir.parent.parent if gitdir.parent.name == "worktrees" else None
+    if common is None or common.name != ".git":
+        return None
+    return common.parent
+
+
 def checkout_root() -> Optional[Path]:
     """The git checkout the cwd is in, resolved through linked worktrees.
 
@@ -979,14 +1003,7 @@ def checkout_root() -> Optional[Path]:
         if git.is_dir():
             return d
         if git.is_file():
-            try:
-                line = git.read_text(encoding="utf-8").strip()
-            except OSError:
-                return d
-            gitdir = line[len("gitdir:"):].strip() if line.startswith("gitdir:") else ""
-            marker = f"{os.sep}.git{os.sep}worktrees{os.sep}"
-            norm = gitdir.replace("/", os.sep)
-            return Path(norm.split(marker)[0]) if marker in norm else d
+            return _worktree_main(git) or d
     return None
 
 

package/scripts/editor/conformance.py

@@ -322,6 +322,22 @@ def _torn(page, wait: bool = False):
         return None
 
 
+def python_with_playwright() -> str | None:
+    """The first python3 / python on PATH that can import playwright. Each is probed, never compared by
+    path: a venv's python links to the same base binary yet sees other site-packages (codex)."""
+    import shutil, subprocess  # noqa: E401, PLC0415
+    for name in ("python3", "python"):
+        exe = shutil.which(name)
+        if exe is None:
+            continue
+        try:
+            if subprocess.run([exe, "-c", "import playwright.sync_api"], capture_output=True, timeout=30).returncode == 0:
+                return exe
+        except (OSError, subprocess.TimeoutExpired):
+            continue
+    return None
+
+
 def manifest_case(pack: Path) -> dict:
     """Case 0: garden's own `pack check` (the same gate wicked-crew runs before an install)."""
     try:
@@ -369,6 +385,13 @@ def main(argv: list[str] | None = None) -> int:
     try:
         from playwright.sync_api import sync_playwright  # noqa: PLC0415
     except ImportError:
+        # The launcher's snapshot venv carries no browser driver (E2E finding F-EDIT-2): run once more
+        # under a python on PATH that has one, with the same arguments.
+        other = python_with_playwright() if not os.environ.get("WG_EDITOR_CONFORMANCE_REEXEC") else None
+        if other is not None:
+            import subprocess  # noqa: PLC0415
+            env = {**os.environ, "WG_EDITOR_CONFORMANCE_REEXEC": "1"}
+            return subprocess.call([other, os.path.abspath(__file__), *(argv if argv is not None else sys.argv[1:])], env=env)
         return out({"ok": False, "pack": str(args.pack), "error": "no headless browser: the Python playwright package is "
                     "not installed (pip install playwright && playwright install chromium); refusing to report conformance "
                     "without the run"}, 3)

package/scripts/editor/install.py

@@ -278,6 +278,17 @@ def do_uninstall(args) -> tuple[int, dict]:
     return 0, out
 
 
+def consent_refusal(args, env) -> str | None:
+    """Inside a governed run (``WICKED_RUN_ID`` set) a live install happens only in the consent-gated
+    Tool unit, the one unit the engine hands ``WICKED_CONSENT_CHOICE`` (the operator's approved
+    choice). Any other unit (a creator in build, a reviewer) may plan with ``--dry-run`` but never
+    installs or uninstalls (E2E finding F-EDIT-1: a creator installed before the gate asked)."""
+    if not env.get("WICKED_RUN_ID") or env.get("WICKED_CONSENT_CHOICE"):
+        return None
+    return ("refusing to install inside a governed run outside its consent-gated install step: the operator "
+            "approves the install at that gate. Plan it with --dry-run; the install step runs it.")
+
+
 def main(argv: list[str] | None = None) -> int:
     parser = argparse.ArgumentParser(description=__doc__.splitlines()[0])
     where = parser.add_mutually_exclusive_group()
@@ -301,6 +312,10 @@ def main(argv: list[str] | None = None) -> int:
         except Failure as err:
             sys.stderr.write(f"editor install --dry-run: {err}\n")
             return err.code
+    refusal = consent_refusal(args, os.environ)
+    if refusal is not None:
+        print(json.dumps({"ok": False, "error": refusal}))
+        return 2
     try:
         code, out = do_uninstall(args) if args.uninstall else do_install(args)
     except Failure as err:

package/scripts/mem/estate_memory.py

@@ -36,9 +36,10 @@ projects' memories need the explicit opt-in ``scope_prefix: ""``.
 
 Durability gate
 ---------------
-`store` / `capture-batch` refuse content that is not a durable learning (see
-``durability_rejects``): too short, or carrying SHAs, versions, PR/run ids,
-PIDs, "today", or first-person progress narration.
+`store` / `capture-batch` refuse only the unambiguous (``durability_rejects``):
+an empty or under-40-char body, a bare id / SHA / version, or first-person
+progress narration. Ids, versions, SHAs, PIDs and dates inside a body are
+advisory ``warnings`` (``durability_warnings``); the store still succeeds.
 
 Erase guard
 -----------
@@ -200,65 +201,57 @@ def _parse_budget(args):
 
 # ── durability gate ─────────────────────────────────────────────────────────
 # A memory must help a fresh session on a different task months from now: it
-# states a rule, why it holds, and when it applies. The skill text asks the
-# agent that question; these checks refuse the mechanical misses outright, so
-# narration and status never reach the store even when the judgment slips.
+# states a rule, why it holds, and when it applies. That judgment is the
+# agent's (the skill text asks it). The backend refuses only what is
+# unambiguous, and WARNS on the rest: an id, version or SHA inside a real rule
+# ("keep SQLite >= 3.35.0 because RETURNING", "CRC32 polynomial edb88320") is
+# fine, so those heuristics never block a store.
 MIN_CONTENT_CHARS = 40
-_HEX_RUN = re.compile(r"\b[0-9a-f]{7,40}\b")
-# A hex run is a commit id when it is long (>= 12) or sits in commit context; a short one
-# alone (a CRC32 polynomial, a colour) is a constant, and constants are durable.
-_COMMIT_CONTEXT = re.compile(
-    r"\b(?:commit|sha|rev(?:ision)?|cherry-?pick(?:ed)?|revert(?:ed)?|fixed in|landed in|merged as"
-    r"|pin(?:ned)?(?: moved)? (?:to|at))\b|@[0-9a-f]{7}", re.I)
-# A version is narration only next to release status ("released 2.4.1", "shipped 0.7.26"); a
-# version constraint ("keep SQLite >= 3.35.0 because RETURNING") is a durable rule.
-_VERSION = re.compile(r"(?<![\w.])v?\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.]+)?(?![.\d])")
-_RELEASE_STATUS = re.compile(
-    r"\b(?:released|shipped|published|tagged|cut|bumped|landed|merged|deployed|rolled out"
-    r"|upgraded to|is out|went out|now on)\b", re.I)
-_NON_DURABLE = (
+# First-person progress narration: "I'll retry", "I'm going to guess again", "We shipped …".
+_NARRATION = re.compile(
+    r"\b(?:i['\u2019]ll|i will|we['\u2019]ll|let me"
+    r"|(?:i['\u2019]m|i am|we['\u2019]re|we are) (?:going|about) to)\b"
+    r"|^(?:i|we)(?: just| finally)? (?:shipped|released|merged|pushed|deployed|landed|tried|retried"
+    r"|restarted|bumped|tagged)\b", re.I)
+# One identifier on its own: a SHA, a version, a uuid, a #123 / repo#123.
+_ID_TOKEN = (r"(?:[0-9a-f]{7,40}|v?\d+\.\d+\.\d+(?:[-+][0-9a-z.]+)?"
+             r"|[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}|[a-z][\w.-]*#\d+|#\d+)")
+_BARE_ID = re.compile(r"^[\W_]*" + _ID_TOKEN + r"[\W_]*$", re.I)
+_ADVISORIES = (
+    (re.compile(r"\b(?=[0-9a-f]*\d)(?=[0-9a-f]*[a-f])[0-9a-f]{7,40}\b", re.I), "a commit SHA?"),
+    (re.compile(r"(?<![\w.])v?\d+\.\d+\.\d+(?![.\d])"), "a version?"),
     (re.compile(r"\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b", re.I),
-     "a run/session id (uuid)"),
-    # x.y.z, but not a dotted quad (127.0.0.1) or a longer dotted run.
-    # PR #12 / issue #12 / run 38093054271 / core#880 / a bare #880 — not "run 3 retries".
+     "a run/session id?"),
     (re.compile(r"\b(?:pr|pull request|issue|run|job)\s*(?:#\s*\d+|\d{5,})\b"
-                r"|\b[a-z][\w.-]*#\d+\b|(?<![\w&])#\d+\b", re.I), "a PR/issue/run id"),
-    # pid 48668 — not "PID 1 is init".
-    (re.compile(r"\bpids?\s*[:=#]?\s*\d{3,}\b", re.I), "a process id"),
+                r"|\b[a-z][\w.-]*#\d+\b|(?<![\w&])#\d+\b", re.I), "a PR/issue/run id?"),
+    (re.compile(r"\bpids?\s*[:=#]?\s*\d{3,}\b", re.I), "a process id?"),
     (re.compile(r"\b(?:today|yesterday|tonight|this (?:morning|afternoon|evening|week))\b", re.I),
-     "a date-relative word"),
-    # I'll / we'll / I'm going to — the apostrophe is required ("ill-formed", "works well").
-    (re.compile(r"\b(?:i['\u2019]ll|i will|we['\u2019]ll|let me"
-                r"|(?:i['\u2019]m|i am|we['\u2019]re|we are) (?:going|about) to)\b", re.I),
-     "first-person progress narration"),
+     "a date-relative word?"),
 )
 
 
-def _is_sha(token):
-    return any(c.isdigit() for c in token) and any(c.isalpha() for c in token)
-
-
 def durability_rejects(content):
-    """Why ``content`` is not a durable learning ([] = it may be stored).
-
-    Deterministic and offline: empty or too-short bodies, commit SHAs (long, or
-    in commit context), versions next to release status,
-    PR/issue/run ids, PIDs, "today"-style dates, and first-person narration
-    ("I'll retry", "going to guess again") are records of a moment; the repo,
-    CHANGELOG or tracker already holds those.
+    """Hard refusals ([] = it may be stored): an empty or under-40-char body, a
+    body that is only an id / SHA / version, or first-person progress narration.
     """
     text = (content or "").strip()
     if len(text) < MIN_CONTENT_CHARS:
         return [f"too short to state a rule, why it holds and when it applies "
                 f"(< {MIN_CONTENT_CHARS} chars)"]
-    reasons = []
-    shas = [m.group(0) for m in _HEX_RUN.finditer(text.lower()) if _is_sha(m.group(0))]
-    if any(len(h) >= 12 for h in shas) or (shas and _COMMIT_CONTEXT.search(text)):
-        reasons.append("a commit SHA")
-    if _VERSION.search(text) and _RELEASE_STATUS.search(text):
-        reasons.append("release status (a version that was shipped/released)")
-    reasons += [why for rx, why in _NON_DURABLE if rx.search(text)]
-    return reasons
+    if _BARE_ID.match(text):
+        return ["only an identifier (a SHA, version or id), not a learning"]
+    if _NARRATION.search(text):
+        return ["first-person progress narration (what was done or will be done)"]
+    return []
+
+
+def durability_warnings(content):
+    """Advisory only: ids, versions, SHAs, PIDs or dates that MAY mark a moment
+    rather than a rule. The store still succeeds; the agent re-checks the
+    three-month test and keeps the memory if it holds.
+    """
+    text = (content or "").strip()
+    return [why for rx, why in _ADVISORIES if rx.search(text)]
 
 
 def _capture_one(item):
@@ -274,7 +267,7 @@ def _capture_one(item):
     rejects = durability_rejects(content)
     if rejects:
         return None, ("not a durable learning (" + "; ".join(rejects) + "): state the rule, "
-                      "why it holds and when it applies, without ids, versions or progress")
+                      "why it holds and when it applies")
     kind = item.get("kind") or "fact"
     if kind not in KINDS:
         return None, f"unknown kind: {kind} (valid: {', '.join(KINDS)})"
@@ -300,7 +293,11 @@ def do_store(args):
     memory_id, err = _capture_one(args)
     if err:
         return _fail_open(err)
-    _emit({"ok": True, "memory_id": memory_id, "scope": args.get("scope") or _default_scope()})
+    out = {"ok": True, "memory_id": memory_id, "scope": args.get("scope") or _default_scope()}
+    warnings = durability_warnings(args.get("content"))
+    if warnings:
+        out["warnings"] = warnings
+    _emit(out)
     return 0
 
 
@@ -402,12 +399,17 @@ def do_capture_batch(args):
         if err:
             failures.append({"index": i, "reason": err})
         else:
-            stored.append({"index": i, "memory_id": memory_id})
+            entry = {"index": i, "memory_id": memory_id}
+            warnings = durability_warnings(item.get("content"))
+            if warnings:
+                entry["warnings"] = warnings
+            stored.append(entry)
     _emit({
         "ok": not failures or bool(stored),
         "stored": len(stored),
         "failed": len(failures),
         "ids": [s["memory_id"] for s in stored],
+        "warnings": [s for s in stored if s.get("warnings")],
         "failures": failures,
     })
     return 0

package/skills/mem/SKILL.md

@@ -87,9 +87,11 @@ A chat seat asked by wicked-crew to label the operator's decisions reads
    when it applies, in 1–3 self-contained sentences. Never store progress or
    status, release versions ("shipped 2.4.1"), commit SHAs, PR/run ids, PIDs,
    "today", or what the repo,
-   CHANGELOG or tracker already records. The backend refuses the mechanical
-   cases with `not a durable learning`; treat that as "don't store", not as
-   an error to work around.
+   CHANGELOG or tracker already records. That test is your judgment. The
+   backend refuses only a body under 40 characters, a bare id / SHA / version
+   and first-person narration (`not a durable learning`: don't store, don't
+   work around it); it stores bodies containing ids, versions or SHAs and
+   returns `warnings` naming them, so check those before you store.
    Provenance: memory is what we witnessed, were told, or decided. A claim
    read from code, docs or the web is knowledge: use `write`
    (`{"content","class":"concept","source"}`) or `ingest` instead; `store`

package/skills/mem-capture/SKILL.md

@@ -54,10 +54,14 @@ Reject, and do not rephrase into something that sneaks past:
 
 A version *constraint* ("needs SQLite >= 3.35.0 because …") and a fixed constant
 (a CRC polynomial, a colour) are durable; keep them.
-The backend refuses the mechanical cases (ids, release versions, commit SHAs, PIDs, "today",
-first-person narration, bodies under 40 characters) with
-`not a durable learning`. A refusal means the candidate failed the test:
-drop it, unless it holds a real rule you can state without the moment.
+The test above is YOUR judgment; the backend only backs it up. It refuses
+(`not a durable learning`) a body under 40 characters, a bare id / SHA /
+version, and first-person progress narration ("I'll retry", "We shipped …"):
+drop those. Ids, versions, SHAs, PIDs or dates inside a body are allowed (a
+version constraint or a fixed constant is a real rule); the backend stores
+the memory and returns `warnings` naming them. Check for them yourself
+before the write, since the warning arrives after it, and report any
+warning with the memory it was attached to.
 If nothing passes, store nothing and say so. An empty capture is a valid
 result, and the usual one.